Standards/Ethernet/Bonjour

Bonjour is Apple's protocol for service discovery. It is lightweight and works over UDP. Bonjour implements a Multicast Domain Name System (mDNS) service without requiring a conventional DNS server.

Bonjour comprises:

• host discovery: finding the IP addresses of .local devices
• service discovery: listing the capabilities of the devices

Bonjour is implemented in Linux systems under the name Avahi. There is also a Windows implementation of Bonjour.

Multicast frames

The mDNS frames are sent to the multicast address 01:00:5E:00:00:FB / 224.0.0.251, from and to port 5353.

Bonjour frames are filtered in Wireshark with the help of the expression:

ip.version==4 and udp.port==5353